hashicorp / hashicorp/vault-helm
Four securityContext parameters are not generated (runAsNonRoot, runAsGroup, runAsUser, fsGroup)
- Dominant language
- Shell
- Stars
- 1.3k
- Forks
- 898
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
[vault-all.yaml.zip](https://github.com/hashicorp/vault-helm/files/4845273/vault-all.yaml.zip)
Helm Chart: 0.6.0
Helm Command (works as expected): `helm template vault vault-0.6.0.tgz > vault-all-new.yaml`
This results in the StatefulSet with the following:
```
securityContext:
runAsNonRoot: true
runAsGroup: 1000
runAsUser: 100
fsGroup: 1000
```
When run with this command all four parameters are omitted from the StatefulSet (runAsNonRoot, runAsGroup, runAsUser, fsGroup).
Helm command (does not generate the securityContext parameters):
```
helm template vault hashicorp/vault --namespace "xyz"
--values "values-minimal.yaml"
--set='server.image.repository=hashicorp/vault-enterprise'
--set='server.image.tag=1.4.2_ent'
--set='server.ha.enabled=true'
--set='server.ha.raft.enabled=true'
--set='server.route.enabled=true'
--set='server.extraEnvironmentVars.VAULT_CACERT=/vault/userconfig/vault-tls/vault.ca'
--set='server.tls.secretName=vault-tls'
--set='global.tlsDisable=false'
--set='global.openshift=true'
> "/home/user/vault-all.yaml"
```
This is the content of **values-minimal.yaml** supplying parameters to the above helm template command:
```
server:
ha:
raft:
config: |
ui = true
listener "tcp" {
tls_disable = 0
tls_cert_file = "/vault/userconfig/vault-tls/vault.crt"
tls_key_file = "/vault/userconfig/vault-tls/vault.key"
address = "[::]:8200"
cluster_address = "[::]:8201"
}
storage "raft" {
path = "/vault/data"
}
service_registration "kubernetes" {}
```
Please find attached the resulting **vault-all.yaml** file.
Contributor guide
Research direction
Reproduce the difference between the two helm template commands using values-minimal.yaml, then compare the generated vault-all.yaml with the attached expected output. Trace the chart template that renders the StatefulSet securityContext; done means runAsNonRoot, runAsGroup, runAsUser, and fsGroup are generated for the reported configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100